What is the CVSS score of CVE-2026-48328?

CVE-2026-48328 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48328?

Adobe ColdFusion (CVE-2026-48328) contains an authentication bypass vulnerability that allows network attackers with low-privileged access to read unauthorized data, potentially exposing sensitive…

How to fix or mitigate CVE-2026-48328?

Within 24 hours: identify and inventory all Adobe ColdFusion production instances, assess their data sensitivity, and implement network segmentation to limit exposure. Within 7 days: enforce strict input validation on authentication pathways, apply principle-of-least-privilege restrictions to ColdFusion service accounts, and enable detailed access logging on sensitive data operations to detect exploitation attempts. Within 30 days: monitor Adobe PSIRT channels for patch release, prepare validated deployment procedures for affected versions, and conduct a data access audit to determine whether the vulnerability was exploited during the interim period.

Adobe ColdFusion CVE-2026-48328

EUVD-2026-44543 HIGH

Improper Input Validation (CWE-20)

2026-07-14 psirt@adobe.com

GHSA-f95m-3r4w-4p94

Authentication Bypass Adobe Coldfusion

7.7

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Remote low-complexity access with an existing low-privileged account and no interaction; a bypass crossing the security boundary (S:C) yields read-only disclosure, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:38 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

HIGH 7.7

DescriptionCVE.org

ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Security feature bypass in Adobe ColdFusion allows a low-privileged, network-based attacker to defeat access controls and obtain unauthorized read access to data outside their intended authorization boundary. Adobe PSIRT classifies the root cause as improper input validation and tags it an authentication bypass; the CVSS 3.1 score is 7.7 with a changed scope, reflecting impact that crosses a security boundary. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided.

Technical ContextAI

ColdFusion is Adobe's commercial rapid web-application development platform and application server (CFML runtime, administrator console, and associated services), commonly deployed to serve dynamic web applications and APIs. The flaw is classified as CWE-20 (Improper Input Validation), meaning the software fails to correctly validate attacker-supplied input before using it in a security-relevant decision, and here that failure manifests as a security-feature/authentication bypass. Because the CVSS scope is Changed (S:C), the vulnerable component's flaw grants access to resources managed by a different security authority, consistent with a bypass that reaches data beyond the attacker's own privilege context.

RemediationAI

Apply the updates described in Adobe Security Bulletin APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html); a patch is available per the vendor advisory, though an exact fixed version number was not included in the provided data and should be taken from that bulletin. As compensating controls until patching completes, restrict network access to the ColdFusion Administrator and application endpoints to trusted management networks, tighten the privileges granted to low-trust authenticated accounts (since exploitation requires PR:L), and monitor logs for anomalous read/access patterns against protected resources; note that restricting Administrator access may disrupt legitimate remote administration and should be coordinated with operations.